The WooCommerce Custom Product Addons Pro plugin allows attackers to run arbitrary PHP code on the server without authentication. The vulnerability is triggered by the use of the eval() function on user‑submitted custom pricing formulas. Because the input is only stripped of HTML tags and not escaped, an attacker can inject PHP code via a custom pricing field (pricingType: "custom") and cause the server to execute that code. This gives the attacker full control over the affected WordPress site, including data theft, defacement, or further compromise.

Vendors from acowebs offer the WooCommerce Custom Product Addons Pro plugin for WordPress. All releases up to and including version 5.4.1 are affected. Sites running WordPress with any of these plugin versions should be considered vulnerable until the issue is addressed or the plugin is updated to a patched release.

The CVSS base score is 9.8, indicating a critical severity. EPSS data is not available, but the high CVSS score alone signals a very high likelihood of exploitation. The vulnerability is not listed in KEV, but its nature—unauthenticated remote code execution—makes it a prime target for automated attacks. Based on the description, the likely attack vector is the public website’s product configuration interface; no authentication is required to submit malicious pricing formulas.